Threat database

A vulnerability in the PublishPress Revisions WordPress plugin before version 4.3.1 allows any authenticated user, including those with Subscriber roles, to access the title, content, and excerpt of private, draft, pending, scheduled, or trashed posts of other users via the revision-comparison feature. This occurs because the plugin does not verify user permissions before returning post content.

The All-in-One Video Gallery WordPress plugin versions before 5.1.0 have a vulnerability where the plugin does not verify the type, status, or ownership of posts before updating view count and duration metadata. This allows unauthenticated users to create or modify meta information on any post, including private and draft posts, and to arbitrarily inflate view counts.

The GutenKit WordPress plugin versions before 2.5.5 improperly sanitize custom CSS saved against posts, allowing users with Author role and above to inject JavaScript that executes in visitors' browsers. This vulnerability affects sites running WordPress versions below 7.0.

The placester WordPress plugin versions through 1.4.3 lack proper capability, nonce, and ownership checks on an AJAX action that updates account details. This flaw allows unauthenticated attackers to overwrite any user's email address, including administrators, enabling account takeover via the password-reset process.

The Wurdey WordPress plugin versions up to 1.0.0 contains a vulnerability where it does not verify request signatures before logging users in. This flaw allows unauthenticated attackers to log in as an administrator if they know the administrator's username.

The GS JWT Authentication for WP REST API WordPress plugin versions through 1.0.0 contains an SQL injection vulnerability due to lack of sanitization or parameterization of request values on several unauthenticated REST routes. This flaw allows unauthenticated attackers to execute SQL injection attacks and potentially obtain an administrator session.

A server-side request forgery (SSRF) vulnerability exists in an undocumented API endpoint of Foxit Workspace. This flaw arises from insufficient validation of user-supplied URL and network parameters, allowing a remote attacker to induce the server to send requests to arbitrary internal or external resources. Exploitation could lead to unauthorized access to internal services, network reconnaissance, and disclosure of sensitive information.

The MCB WordPress plugin up to version 1.0.0 fails to sanitize or escape request header values before storing and displaying them in the administrator statistics grid. This vulnerability allows unauthenticated attackers to inject malicious JavaScript, which executes in the browser of an administrator viewing the statistics page.

The Advanced Custom Fields (ACF®) WordPress plugin versions before 6.8.11 contain a vulnerability where a stored field definition is not properly sanitized. This flaw allows unauthenticated users to inject malicious payloads via comment handling, which are then emitted as HTML attribute names and executed as JavaScript in the browsers of visitors or administrators viewing the affected field.

The Mail Mage WordPress plugin versions through 0.0.25 contain a vulnerability where user-supplied input is not properly sanitized and escaped before being used in a SQL statement. This flaw allows unauthenticated attackers to perform SQL injection attacks against affected installations.

A vulnerability in Keycloak's Dynamic Client Registration (DCR) endpoint allows an authenticated attacker with client creation privileges or an Initial Access Token (IAT) to inject excessive roles into the realm's default roles configuration. This results in clients generating bloated access tokens, causing performance and memory degradation that can lead to denial of service (DoS). The flaw does not grant unauthorized access to protected resources but impacts availability due to resource exhaustion.

A vulnerability in the OIDC logout endpoint of the keycloak-services component in Red Hat Build of Keycloak allows an attacker to fix a session ID in a victim's browser before security checks are completed. This flaw enables session fixation, potentially leading to full account takeover, including administrative accounts. The issue arises from setting session cookies based on unvalidated token hints and reusing authentication session IDs during login. No effective mitigation or patch is currently available from Red Hat.

CVE-2026-119431 is a server-side request forgery (SSRF) vulnerability in Foxit Workspace's file-upload functionality. It arises from insufficient validation of user-supplied links, allowing a remote attacker to make the server access internal resources and potentially disclose sensitive information or gain unauthorized access to internal services.

A stored cross-site scripting (XSS) vulnerability in Foxit Workspace's file share preview allows attackers to execute malicious scripts when a victim previews a crafted file. This can lead to credential theft by accessing locally stored credentials within the application's origin.

CVE-2026-114366 is an information disclosure vulnerability in the Qt Framework's QWebSocket authentication handling within the Qt WebSockets module. The flaw could potentially allow unauthorized information exposure during authentication processes. The vulnerability has a medium severity rating with a CVSS score of 6. No affected versions or patch information are provided in the available data.

CVE-2026-89142 is a vulnerability in the Wi-Fi NPU firmware involving a possible out-of-bounds write caused by an incorrect bounds check. Exploitation requires local user privileges but no user interaction. The flaw can lead to a denial of service condition.

A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources.

A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.

A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens.

A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator.